AI in Cyberattacks

by Victor Angelier

What changes & What does not

Three major security reports were published within the past six months: the UK AI Security Institute’s Frontier AI Trends Report, Check Point Research’s AI Security Report 2026 and CrowdStrike’s 2026 Global Threat Report.

Read separately, each presents only part of the picture. The AI Security Institute evaluates what advanced AI models can do under controlled conditions. Check Point reconstructs specific criminal operations using evidence gathered through its own research. CrowdStrike analyses trends across its proprietary threat telemetry and incident-response work.

These reports do not form a single evidentiary chain, nor do they independently confirm every claim made by the others. Their findings are nevertheless directionally consistent.

AI is not rewriting the basic rules of cyberattacks. It is accelerating the execution of techniques that already work, reducing the expertise needed to use them and enabling individual operators to act at a scale previously associated with larger teams.

At the same time, autonomous AI systems are introducing a new control surface that many organisations have not yet brought within their existing governance structures.

That combination matters.

The shift that matters

Generative AI is moving from being a preparation tool to becoming an operational actor.

Until recently, attackers primarily used AI to improve activities surrounding an attack: drafting more convincing phishing messages, researching targets, translating communications, analysing vulnerabilities or generating fragments of code.

The underlying intrusion remained directly controlled and executed by a human. AI reduced preparation time, but the attacker still performed the operational steps.

The cases now being described indicate a different pattern.

Check Point Research reconstructed an operation targeting Mexican government institutions in which a single operator reportedly compromised nine organisations and exposed approximately 400 million records. According to Check Point’s analysis, the operator entered 1,088 instructions while an AI system produced and executed 5,317 commands.

These figures are based on attacker-side server and log data obtained by Check Point. There has been no public, independent forensic confirmation from the Mexican government, so they should be understood as Check Point’s reconstruction rather than independently verified operational facts.

Even with that qualification, the pattern is significant.

The human operator retained strategic control. The attacker selected the targets, determined the objectives and intervened when the system needed correction. The AI system then performed a substantially larger volume of operational work than the operator entered manually.

The shift is therefore not the disappearance of human intent. It is the movement of AI into the execution layer.

One person can direct a system that enumerates environments, creates scripts, executes commands, analyses results and adapts subsequent actions. Activities that previously required sustained manual effort can be compressed into shorter operating cycles.

That changes the economics and speed of cyberattacks, even when the techniques themselves remain familiar.

What the numbers show

The UK AI Security Institute has been benchmarking frontier AI models on cybersecurity tasks since 2024.

Its results show a steep improvement in capability.

In early 2024, the strongest evaluated models completed entry-level cybersecurity tasks successfully approximately 10% of the time. By late 2025, that figure had risen to around 50%.

AISI also reported that, for the first time, a model successfully completed selected tasks assessed as requiring more than a decade of human specialist experience.

This does not mean that frontier models consistently operate as experienced cybersecurity professionals. Performance remains uneven, particularly across complex, realistic and multi-stage attack scenarios. Models may complete an initial step successfully and still fail when required to maintain context, recover from unexpected results or make sound decisions over a longer sequence of actions.

The direction of travel is nevertheless clear.

Based on the evaluation methodology used by the non-profit research organisation METR, AISI estimates that the length of tasks AI systems can complete autonomously is doubling approximately every eight months.

CrowdStrike describes a threat environment undergoing similar acceleration.

Its 2026 report states that the average eCrime breakout time — the period between initial access and lateral movement into another system — fell to 29 minutes. That represents a 65% reduction year on year.

CrowdStrike also reports an 89% year-on-year increase in activity attributed to what it classifies as “AI-enabled adversaries”.

These figures come from CrowdStrike’s own telemetry and incident-response data. They do not isolate AI as the sole cause of faster attacks. Changes in attacker tooling, infrastructure, access brokerage, identity theft and operational practices may also contribute.

The reports therefore do not prove that AI independently caused the observed acceleration.

They do, however, describe a threat environment in which attacks are becoming faster, more scalable and easier to execute. That is the operating reality security teams must address.

The new control surface

The most important governance issue may not be the model itself.

It may be the instructions around it.

AI agents are systems that can plan, use tools, execute actions and adapt their behaviour in pursuit of an objective. Depending on their role, they may be able to modify code, query databases, interact with cloud environments, open files, run commands or change operational workflows.

Many of these systems read configuration files as authoritative instructions.

A file such as CLAUDE.md, for example, may be loaded automatically by certain AI development environments. Its contents can influence how the agent behaves, which tools it uses and which restrictions it follows.

The instruction is not merely displayed to a user. It becomes part of the agent’s operating context.

Attackers have recognised the significance of this mechanism. Check Point reports that ready-made jailbreak packages designed for AI configuration files are already circulating in criminal communities.

In the Mexican government operation reconstructed by Check Point, the AI system initially refused to perform certain actions. The attacker then added an instruction to a configuration file. Subsequent sessions reportedly followed the modified instruction without requiring the same intervention again.

This does not represent a universal vulnerability affecting every AI system. It is one observed mechanism within a particular deployment model.

For organisations using AI agents in software development, infrastructure operations, security, customer service or business processes, however, it illustrates a structural issue: configuration can function as control.

That raises questions many organisations have not previously needed to answer.

Who may change an agent’s instructions? How are those changes reviewed? Are configuration files version-controlled? Can the organisation reconstruct which instructions were active when an agent performed a particular action? Are changes subject to the same approval and audit requirements as changes to application code?

Prompts, policy files, tool permissions and agent configurations may look like documentation. Operationally, they can determine system behaviour.

Where that is the case, they should be governed accordingly.

What has not changed

The underlying logic of most cyberattacks remains largely familiar.

Attackers still exploit weak authentication. They still use stolen credentials. They still take advantage of known vulnerabilities and incorrect configurations. They still move laterally between systems and escalate privileges until they reach valuable data or operational control.

CrowdStrike reports that 82% of detected intrusions during 2025 involved no malware. Attackers instead relied on valid credentials and trusted software being used for unauthorised purposes.

That percentage reflects CrowdStrike’s own detection data and does not, by itself, establish how AI has affected the proportion of malware-free attacks.

It nevertheless reinforces an important point: many successful intrusions do not depend on technically novel attack methods.

AI makes proven techniques faster, cheaper and accessible to a larger group of operators. It can assist with reconnaissance, generate commands, interpret outputs, translate instructions and adapt scripts. What it does not necessarily do is replace credential theft, privilege escalation or lateral movement with something fundamentally different.

This matters for investment priorities.

The organisations most exposed to AI-accelerated attacks are not necessarily those without a specialised AI security product. They are often those that still have weak multifactor authentication, excessive access rights, poorly protected credentials, unpatched systems or insufficient segmentation between critical environments.

For most organisations, strengthening these fundamentals remains a first-order priority.

Where AI agents already operate with privileged access, agent-specific controls belong in that same first-order category. An agent capable of changing production code, modifying cloud resources or accessing sensitive information should not be treated as an ordinary productivity tool.

Traditional security controls and AI-specific governance are not competing approaches. The latter should extend the former.

The accountability challenge

AI-assisted execution also complicates attribution and accountability.

In the cases described by the reports, AI involvement became visible through provider-side or attacker-side evidence rather than through independent detection by the targeted organisations.

Security monitoring may reveal that an account executed a command or that a system accessed a resource. It may not reveal whether a human typed the command, generated it using an AI assistant or delegated a wider objective to an autonomous agent.

This creates both an investigative and a governance problem.

When an AI agent performs part of an intrusion, who acted?

The human operator may have selected the objective. The AI system may have determined and executed individual steps. A model provider may have supplied the underlying capability. A separate organisation may have configured the tools, permissions or safeguards.

The existence of multiple technical participants does not remove human responsibility. It does, however, make the chain of action more difficult to reconstruct.

The same problem exists within legitimate organisations.

When an internal AI agent changes a system, sends a communication, modifies a record or makes an operational decision, the organisation must be able to establish:

• who authorised the agent;
• which objective it received;
• which configuration and policy version applied;
• which tools and credentials it used;
• which actions it performed;
• where human approval was required;
• and who remained accountable for the outcome.

These questions are not yet fully settled in law or professional practice. Organisations should not wait for a court or regulator to define every detail before establishing their own control framework.

Logging, change governance and clear ownership are not merely technical safeguards. They are the basis on which accountability can later be demonstrated.

5 questions leadership teams should ask

The strategic issue is not whether AI has transformed every aspect of cyber risk. It is whether governance has kept pace with the speed at which AI systems are being deployed.

Leadership teams should begin with five questions.

1. Where can AI systems take action?

Identify every AI system that can do more than generate text.

This includes agents that can run commands, modify code, access files, interact with cloud platforms, query sensitive data, update customer records or trigger business processes.

The relevant distinction is not whether a system is described as an assistant or an agent. It is whether it possesses execution rights.

2. Who can change the instructions?

Determine who may modify system prompts, policy files, agent configuration, tool access and behavioural constraints.

These assets should have named owners, appropriate access restrictions and documented change procedures. Where configuration affects operational behaviour, informal edits should not be possible without traceability.

3. Can the organisation reconstruct what happened?

Logs should cover more than the final output.

Organisations need sufficient evidence to reconstruct the objective given to the agent, the instructions active at the time, the tools it called, the actions it performed and any human approvals or interventions.

Without this evidence, accountability becomes an assumption rather than a demonstrable fact.

4. Are identity controls designed for machine speed?

A 29-minute breakout time leaves little room for slow detection and manual escalation.

Review multifactor authentication, privilege boundaries, credential duration, service accounts and network segmentation against an environment in which reconnaissance and lateral movement may be accelerated by AI.

Controls designed around human operating speed may no longer provide the expected margin for intervention.

5. Which decisions must remain human?

Define the boundary between actions an agent may propose, actions it may perform independently and actions that always require explicit human approval.

The higher the potential impact, the stronger that boundary should be.

This is particularly important for production changes, security controls, financial transactions, legally significant communications and access to sensitive information.

A calibrated view

The debate around AI and cybersecurity often produces two competing narratives.

The first claims that AI has fundamentally transformed the threat landscape and made existing security approaches obsolete.

The second argues that AI is overhyped because attackers continue to use the same techniques they have always used.

Neither conclusion is supported when the three reports are read together.

The underlying attack patterns remain largely recognisable. Identity compromise, privilege escalation, lateral movement and configuration weaknesses continue to play central roles.

What has changed is the speed, scale and availability of execution.

AI systems can help individual operators perform more work, reduce the expertise required for certain tasks and shorten the time between initial access and operational impact. Agentic systems also introduce instruction and configuration layers that can directly influence execution.

For senior leaders, the practical question is not whether AI has changed everything.

It is whether the organisation knows where AI can act, who controls its instructions, how its behaviour is monitored and who remains accountable when something goes wrong.

The exposure does not arise because AI has replaced every established security principle.

It arises because AI has changed enough to amplify existing weaknesses while introducing new ways for systems to receive and execute instructions.

Governance must now account for both.

How TLA&C can help

TLA&C helps boards and executive teams assess where AI has introduced new execution rights and control surfaces across technology, operations and customer-facing processes.

This includes mapping agent capabilities and privileges, bringing prompts and configuration files into formal change governance, defining appropriate human-oversight thresholds and ensuring that agent activity can be reconstructed through adequate logging and audit evidence.

The objective is not to create a separate governance universe for AI.

It is to extend proven disciplines — identity management, access control, change governance, segmentation, operational resilience and executive accountability — to systems that can now interpret instructions and execute work at increasing speed.

Bibliography

UK AI Security Institute, Frontier AI Trends Report, December 2025.

Check Point Research, AI Security Report 2026.

CrowdStrike, 2026 Global Threat Report.

This article reflects the author’s interpretation of publicly available research and does not constitute legal or cybersecurity advice.

Researched and drafted with AI assistance, edited and fact-checked by the author. Illustration: AI-generated.